[GH-ISSUE #3118] [bug]: whitelisted_origins for CORS being ignored for proxied URLs for /graphql endpoint

kerem commented

2026-03-16 18:09:46 +03:00

Owner

Originally created by @conall88 on GitHub (Jun 6, 2023).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/3118

Is there an existing issue for this?

I have searched the existing issues

Current behavior

When running the backend app with CORS set to production settings, the /graphql endpoint will return HTTP 521 "CORS Missing Allow Origin" even when the relevant path is specified in .env, in cases where a reverse proxy is present.

I'm trying to set this up using the docker compose method.

below are the relevent conf snippets:

.ENV

# Hoppscotch App Domain Config
REDIRECT_URL="http://localhost:80"
WHITELISTED_ORIGINS = "http://localhost:3170,http://localhost:3000,http://localhost:3100,https://hoppscotch.conall.org:8443,https://hoppscotch.conall.org:2053,https://hoppscotch.conall.org:2096,https://hoppscotch.conall.org:2087"

frontend config:

# Backend URLs
VITE_BACKEND_GQL_URL=https://hoppscotch.conall.org:2087/graphql
VITE_BACKEND_WS_URL=ws://hoppscotch.conall.org:2087/graphql
VITE_BACKEND_API_URL=https://hoppscotch.conall.org:2087/v1

I've attached a .HAR file incl the response here: har file.zip

Other endpoints seem to work fine so far, and similar cloudflare proxy configuration is working fine for other applications / kubernetes containers.

Port 2087 may be used for HTTPS workloads with cloudflare, and i've set the proxy to flexible encryption, meaning encryption between the cloudflare loadbalancer and the browser only.

Let me know if there is a debug log I can enable to narrow down the issue further. I didn't see anything via info/warn level logs Thanks.

Steps to reproduce

set port 2096 for the hoppscotch-sh-admin container in .env
docker compose build
docker compose up -d
expose the hoppscotch-sh-admin container behind a reverse proxy which proxies requests from http://localhost:2096 to https://<somehost>:2096
open https://somehost:2096 in a browser.
see the POST and OPTIONS to /graphql at https://<somehost>:2087 fail.

Environment

Production

Version

Self-hosted

Originally created by @conall88 on GitHub (Jun 6, 2023). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/3118 ### Is there an existing issue for this? - [X] I have searched the existing issues ### Current behavior When running the backend app with CORS set to production settings, the /graphql endpoint will return HTTP 521 "CORS Missing Allow Origin" even when the relevant path is specified in .env, in cases where a reverse proxy is present. ![image](https://github.com/hoppscotch/hoppscotch/assets/10930485/c2dc21da-f02f-4877-80ad-a1a1e89aec73) I'm trying to set this up using the docker compose method. below are the relevent conf snippets: .ENV ``` # Hoppscotch App Domain Config REDIRECT_URL="http://localhost:80" WHITELISTED_ORIGINS = "http://localhost:3170,http://localhost:3000,http://localhost:3100,https://hoppscotch.conall.org:8443,https://hoppscotch.conall.org:2053,https://hoppscotch.conall.org:2096,https://hoppscotch.conall.org:2087" ``` frontend config: ``` # Backend URLs VITE_BACKEND_GQL_URL=https://hoppscotch.conall.org:2087/graphql VITE_BACKEND_WS_URL=ws://hoppscotch.conall.org:2087/graphql VITE_BACKEND_API_URL=https://hoppscotch.conall.org:2087/v1 ``` I've attached a .HAR file incl the response here: [har file.zip](https://github.com/hoppscotch/hoppscotch/files/11667520/har.file.zip) Other endpoints seem to work fine so far, and similar cloudflare proxy configuration is working fine for other applications / kubernetes containers. [Port 2087 ](https://developers.cloudflare.com/fundamentals/get-started/reference/network-ports/#:~:text=2083-,2087,-2096)may be used for HTTPS workloads with cloudflare, and i've set the proxy to flexible encryption, meaning encryption between the cloudflare loadbalancer and the browser only. Let me know if there is a debug log I can enable to narrow down the issue further. I didn't see anything via info/warn level logs Thanks. ### Steps to reproduce set port 2096 for the hoppscotch-sh-admin container in .env docker compose build docker compose up -d expose the hoppscotch-sh-admin container behind a reverse proxy which proxies requests from `http://localhost:2096` to `https://<somehost>:2096` open https://somehost:2096 in a browser. see the POST and OPTIONS to /graphql at `https://<somehost>:2087` fail. ### Environment Production ### Version Self-hosted

kerem

2026-03-16 18:09:46 +03:00

closed this issue
added the
bug

need testing

self-host
labels

kerem commented

2026-03-16 18:10:03 +03:00

Author

Owner

@conall88 commented on GitHub (Jun 12, 2023):

I just noticed this behaviour affects the default configuration example, and i've been looking for a first issue in an OSS project, so I hope this is welcome:

I see this CORS handling is being done by nestJS as per:
https://docs.nestjs.com/security/cors

First theory is that the the NodeJS env vars aren't being read properly via process.env..split

I've therefore set :

    console.log('Enabling CORS with development settings');

    app.enableCors({
      origin: [
        'http://localhost:3170',
        'http://localhost:3000',
        'http://localhost:3100',
      ],
      credentials: true,
    });

and set

PRODUCTION=false

in .env to test after doing a build.

outcome:

CORS directives are respected and functional:

so it looks like github.com/hoppscotch/hoppscotch@e3dd9e99a1/packages/hoppscotch-backend/src/main.ts (LL32) is the culprit.

I haven't been able to solve, but did add some improved logging to show that the env vars are being passed in properly (the port numbers aren't significant here, i tested in a new env).

Unfortunately I don't seem to have permissions to publish branches to this repo even though it's marked as public...

@conall88 commented on GitHub (Jun 12, 2023): I just noticed this behaviour affects the default configuration example, and i've been looking for a first issue in an OSS project, so I hope this is welcome: I see this CORS handling is being done by nestJS as per: https://docs.nestjs.com/security/cors First theory is that the the NodeJS env vars aren't being read properly via process.env.<VAR>.split I've therefore set : ``` if (process.env.PRODUCTION === 'false') { console.log('Enabling CORS with development settings'); app.enableCors({ origin: [ 'http://localhost:3170', 'http://localhost:3000', 'http://localhost:3100', ], credentials: true, }); ``` and set ``` PRODUCTION=false ``` in .env to test after doing a build. outcome: CORS directives are respected and functional: ![image](https://github.com/hoppscotch/hoppscotch/assets/10930485/77261ef5-f99e-4386-b76a-205bb3fe7c3f) so it looks like https://github.com/hoppscotch/hoppscotch/blob/e3dd9e99a1951f795149b70bcba46295cf09f712/packages/hoppscotch-backend/src/main.ts#LL32 is the culprit. I haven't been able to solve, but did add some improved logging to show that the env vars are being passed in properly (the port numbers aren't significant here, i tested in a new env). Unfortunately I don't seem to have permissions to publish branches to this repo even though it's marked as public... ![image](https://github.com/hoppscotch/hoppscotch/assets/10930485/3538d31a-796b-4be4-8a03-715d6c7a689d)

kerem commented

2026-03-16 18:10:08 +03:00

Author

Owner

@talenta-eg commented on GitHub (Jun 13, 2023):

@conall88 Great job bro , does you right now can't login via email or Auth through HTTP ?

@talenta-eg commented on GitHub (Jun 13, 2023): @conall88 Great job bro , does you right now can't login via email or Auth through HTTP ?

kerem commented

2026-03-16 18:10:13 +03:00

Author

Owner

@conall88 commented on GitHub (Jun 13, 2023):

CORS directives do not require auth. the auth functionality provided by sh-admin isn't at issue here, i'm sure they work fine otherwise.

https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

@conall88 commented on GitHub (Jun 13, 2023): CORS directives do not require auth. the auth functionality provided by sh-admin isn't at issue here, i'm sure they work fine otherwise. https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

kerem commented

2026-03-16 18:10:19 +03:00

Author

Owner

@conall88 commented on GitHub (Jun 13, 2023):

please edit your post, you should not be sharing your oauth secrets.

they are called secrets for a reason, and i doubt you want a malicious actor taking your token and logging into services you auth via github.

That CORS error you posted is related to sentry APM, not hoppscotch. You need to configure your proxy accordingly.

For the graphQL post requests, check your Haproxy logs.

@conall88 commented on GitHub (Jun 13, 2023): please edit your post, you should not be sharing your oauth secrets. they are called secrets for a reason, and i doubt you want a malicious actor taking your token and logging into services you auth via github. That CORS error you posted is related to sentry APM, not hoppscotch. You need to configure your proxy accordingly. For the graphQL post requests, check your Haproxy logs.

kerem commented

2026-03-16 18:10:24 +03:00

Author

Owner

@cventastic commented on GitHub (Aug 17, 2023):

Hello,

im trying to understand this problem. (I use the 2023.08 release)
My .env - File has the following entries (i replaced my domain for privacy reasons):

REDIRECT_URL="http://hoppscotch-frontend.docker-int.mydomain.tld"
WHITELISTED_ORIGINS="http://hoppscotch-backend.docker-int.mydomain.tld,http://hoppscotch-frontend.docker-int.mydomain.tld,http://hoppscotch-dash.docker-int.mydomain.tld"

VITE_BASE_URL=http://hoppscotch-frontend.docker-int.mydomain.tld
VITE_SHORTCODE_BASE_URL=http://hoppscotch-frontend.docker-int.mydomain.tld
VITE_ADMIN_URL=http://hoppscotch-dash.docker-int.mydomain.tld

# Backend URLs
VITE_BACKEND_GQL_URL=http://hoppscotch-backend.docker-int.mydomain.tld/graphql
VITE_BACKEND_WS_URL=ws://hoppscotch-backend.docker-int.mydomain.tld/graphql
VITE_BACKEND_API_URL=http://hoppscotch-backend.docker-int.mydomain.tld/v1

The hoppscotch-app - container has no problem querying the backend:

and the hoppscotch-sh-admin - container cant query the backend i get:

I tried to set

PRODUCTION=false

but looking at the code it doesnt seem to do anything anyway.

What is the difference between hoppscotch-app - container querying the backend and hoppscotch-sh-admin - container querying the backend?

Update:

Since i use traefik i was able to work around this by creating my own cors headers for the backend container. i pasted the exact same values that are defined in WHITELISTED_ORIGINS env variable :

      - "traefik.http.middlewares.cors.headers.accesscontrolallowmethods=GET,OPTIONS,PUT"
      # I dont know why * is not working for allow headers. but i had to set content-type explicitly.
      - "traefik.http.middlewares.cors.headers.accesscontrolallowheaders=content-type"
      - "traefik.http.middlewares.cors.headers.accesscontrolmaxage=100"
      - "traefik.http.middlewares.cors.headers.accesscontrolalloworiginlist=http://hoppscotch-backend.docker-int.mydomain.tld,http://hoppscotch-frontend.docker-int.mydomain.tld,http://hoppscotch-dash.docker-int.mydomain.tld"
      - "traefik.http.middlewares.cors.headers.accesscontrolallowcredentials=true"
      - "traefik.http.routers.hoppscotch-backend.middlewares=cors"

@cventastic commented on GitHub (Aug 17, 2023): Hello, im trying to understand this problem. (I use the 2023.08 release) My .env - File has the following entries (i replaced my domain for privacy reasons): ``` REDIRECT_URL="http://hoppscotch-frontend.docker-int.mydomain.tld" WHITELISTED_ORIGINS="http://hoppscotch-backend.docker-int.mydomain.tld,http://hoppscotch-frontend.docker-int.mydomain.tld,http://hoppscotch-dash.docker-int.mydomain.tld" VITE_BASE_URL=http://hoppscotch-frontend.docker-int.mydomain.tld VITE_SHORTCODE_BASE_URL=http://hoppscotch-frontend.docker-int.mydomain.tld VITE_ADMIN_URL=http://hoppscotch-dash.docker-int.mydomain.tld # Backend URLs VITE_BACKEND_GQL_URL=http://hoppscotch-backend.docker-int.mydomain.tld/graphql VITE_BACKEND_WS_URL=ws://hoppscotch-backend.docker-int.mydomain.tld/graphql VITE_BACKEND_API_URL=http://hoppscotch-backend.docker-int.mydomain.tld/v1 ``` The hoppscotch-app - container has no problem querying the backend: ![image](https://github.com/hoppscotch/hoppscotch/assets/13015146/89e66bbc-5398-44cc-92a6-e13a4dc96f0c) and the hoppscotch-sh-admin - container cant query the backend i get: ![image](https://github.com/hoppscotch/hoppscotch/assets/13015146/5aa2e610-9afa-46ed-ba46-302354b00b07) I tried to set ``` PRODUCTION=false ``` but looking at the [code](https://github.com/hoppscotch/hoppscotch/blob/release/2023.8.0/packages/hoppscotch-backend/src/main.ts#L31-L45) it doesnt seem to do anything anyway. What is the difference between hoppscotch-app - container querying the backend and hoppscotch-sh-admin - container querying the backend? Update: Since i use traefik i was able to work around this by creating my own cors headers for the backend container. i pasted the exact same values that are defined in WHITELISTED_ORIGINS env variable : ``` - "traefik.http.middlewares.cors.headers.accesscontrolallowmethods=GET,OPTIONS,PUT" # I dont know why * is not working for allow headers. but i had to set content-type explicitly. - "traefik.http.middlewares.cors.headers.accesscontrolallowheaders=content-type" - "traefik.http.middlewares.cors.headers.accesscontrolmaxage=100" - "traefik.http.middlewares.cors.headers.accesscontrolalloworiginlist=http://hoppscotch-backend.docker-int.mydomain.tld,http://hoppscotch-frontend.docker-int.mydomain.tld,http://hoppscotch-dash.docker-int.mydomain.tld" - "traefik.http.middlewares.cors.headers.accesscontrolallowcredentials=true" - "traefik.http.routers.hoppscotch-backend.middlewares=cors" ```

kerem commented

2026-03-16 18:10:29 +03:00

Author

Owner

@AndrewBastin commented on GitHub (Sep 6, 2023):

@conall88 this should ideally be fixed in the 2023.8.0 release.

Please do recheck and reopen if the issue still persists.

Thanks ^_^

@AndrewBastin commented on GitHub (Sep 6, 2023): @conall88 this should ideally be fixed in the 2023.8.0 release. Please do recheck and reopen if the issue still persists. Thanks ^_^

kerem commented

2026-03-16 18:10:34 +03:00

Author

Owner

@conall88 commented on GitHub (Sep 6, 2023):

Awesome, il probably build the branch and check it out a little early,
thanks for your efforts 🙂

On Wed, 6 Sept 2023, 17:47 Andrew Bastin, @.***> wrote:

Closed #3118 https://github.com/hoppscotch/hoppscotch/issues/3118 as
completed.

—
Reply to this email directly, view it on GitHub
https://github.com/hoppscotch/hoppscotch/issues/3118#event-10298364658,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/ACTMSNJW2WZTYNAUUBDU7A3XZCSKLANCNFSM6AAAAAAY4YHL2Y
.
You are receiving this because you were mentioned.Message ID:
@.***>

@conall88 commented on GitHub (Sep 6, 2023): Awesome, il probably build the branch and check it out a little early, thanks for your efforts 🙂 On Wed, 6 Sept 2023, 17:47 Andrew Bastin, ***@***.***> wrote: > Closed #3118 <https://github.com/hoppscotch/hoppscotch/issues/3118> as > completed. > > — > Reply to this email directly, view it on GitHub > <https://github.com/hoppscotch/hoppscotch/issues/3118#event-10298364658>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/ACTMSNJW2WZTYNAUUBDU7A3XZCSKLANCNFSM6AAAAAAY4YHL2Y> > . > You are receiving this because you were mentioned.Message ID: > ***@***.***> >

kerem commented

2026-03-16 18:10:39 +03:00

Author

Owner

@cventastic commented on GitHub (Sep 11, 2023):

for me the problem still exists in 2023.08.0

@cventastic commented on GitHub (Sep 11, 2023): for me the problem still exists in 2023.08.0

kerem commented

2026-03-16 18:10:44 +03:00

Author

Owner

@jk779 commented on GitHub (Oct 6, 2023):

Hi, sadly I'm still running in this problem: accessing graphql from the admin

I'm using this https://hub.docker.com/r/hoppscotch/hoppscotch Tag 2023.8.1 and added all domains to the whitelist.

@jk779 commented on GitHub (Oct 6, 2023): Hi, sadly I'm still running in this problem: accessing graphql from the admin I'm using this https://hub.docker.com/r/hoppscotch/hoppscotch Tag 2023.8.1 and added all domains to the whitelist. ![Bildschirmfoto 2023-10-06 um 20 16 34](https://github.com/hoppscotch/hoppscotch/assets/1104528/ccb38be2-c0be-4b29-8aa7-c142ad2102db)

kerem referenced this issue

2026-03-17 00:40:03 +03:00

[PR #1026] [MERGED] Bump firebase from 7.17.0 to 7.17.1 #3012

Rows
Columns

[GH-ISSUE #3118] [bug]: whitelisted_origins for CORS being ignored for proxied URLs for /graphql endpoint #1026

Is there an existing issue for this?

Current behavior

Steps to reproduce

Environment

Version